Pegasus Project

Reading time : 5 min.

Over several months French authorities weighed acquiring the notorious spyware system. Fresh materials examined by Forbidden Stories lay out the internal strategies prepared at the exact moment Morocco seems to have secretly focused on cabinet members through Pegasus. The Élysée Palace finally blocked the deal after an abrupt change in direction.

Credit: Mélody da Fonseca

Our disclosures

During a hearing examined by Forbidden Stories the NSO reseller in France described talks with intelligence services and cited a figure of 60 to 80 million euros for the software deal.
The Élysée Palace withdrew support by late 2020 citing risks to reputation and national control.
An application to authorize Pegasus sales in France reached the Cybersecurity Agency after the presidency rejected the purchase.
Seven phones of serving ministers displayed indicators of Pegasus compromise matching patterns seen on devices linked to Morocco.

By Eloïse Layan, Hicham Mansouri and Guillaume Vénétitay

July 16th 2026

Even disciplined public servants guard private matters. Sébastien Lecornu used the word vassal to signal allegiance to Emmanuel Macron upon becoming prime minister. The phrase suggests restraint and simplicity.

Yet Morocco showed interest in Lecornu activities and background. In July 2019 while the Normandy politician still served as minister for local affairs the Kingdom reportedly directed Pegasus at his device through NSO.

Sébastien Lecornu at École Polytechnique in October 2022 (Credit: École Polytechnique / J. Barande / CC BY-SA 2.0).

The former Vernon mayor shows no resentment and France likewise maintains steady ties. Lecornu heads to Rabat on July 15 and 16 with twelve ministers for a senior-level session meant to strengthen renewed relations between the two nations. This occurs as Forbidden Stories and partners release further findings on Moroccan surveillance campaigns including the breach of seven French ministers devices in 2019 and 2020 via Pegasus.

New records reviewed by the consortium reveal a deeper narrative: France spent many months examining Pegasus acquisition even while senior officials already figured among its unaware targets.

60 to 80 million euros for Pegasus

No journey to NSO base in Herzliya is required to grasp French interest in Pegasus. A stop in Angoulême suffices. There 52-year-old Jérôme S. resides in a discreet home. He leads Syans a five-person firm in 2022 that has long supported French intelligence bodies including the DGSI. Syans also serves as the sole NSO distributor inside France.

Investigators questioned Jérôme during the French inquiry opened after Pegasus victim complaints. In the session reviewed by the consortium he described France-specific features such as a short malware lifespan and automatic deletion to hinder detection. He also disclosed his expected fee of 50 000 to 65 000 euros and the quoted price of 60 to 80 million euros for the full package. Contacted later Jérôme declined comment to safeguard commercial interests.

Several agencies urged Pegasus adoption

Near the start of 2020 the DGSI and military intelligence unit appeared as likely Pegasus users according to consortium-reviewed files. The Justice Ministry also examined the tool for probes into narcotics or terrorism. A French intelligence official confirmed that several departments advocated for Pegasus and noted that planned domestic uses stayed within legal bounds.

Some voiced clear support for the capability. Jean-Dominique Nollet a Saint-Cyr graduate who moved from the army to the Gendarmerie met NSO representatives in Prague around 2016 to 2017 and later at company headquarters while assigned to Europol. At Europol the team found the performance striking both for rapid deployment and data retrieval. Supplying only a phone number allowed infection in roughly 20 seconds Nollet now at TotalEnergies told investigators. In Herzliya he recalled a compact room packed with every iOS and Android model under constant testing for infection methods.

Signs of Morocco in hacked French ministers case

While ministries advanced their plans they remained unaware of prior compromise. Across the Mediterranean Morocco had operated Pegasus since late 2017. In response to a November 2022 court order the DGSE confirmed that the United Arab Emirates and Morocco had used NSO products since at least 2017 an assertion the Kingdom has consistently rejected. The 2021 Pegasus Project disclosures stunned observers when numbers for Macron and fifteen officials appeared on a Moroccan target list. A senior intelligence figure noted that analysis results for Macron phone stayed confined to the Élysée under strict secrecy.

Pegasus Project Français English A worldwide collaboration to counter a global crime An unprecedented...

Consistent with the secrecy around the head of state no details surfaced about possible compromise of his device. Yet additional evidence reviewed by the consortium verifies compromise indicators on seven ministers phones from that period: Jean-Michel Blanquer Jacqueline Gourault Julien Denormandie Emmanuelle Wargon François de Rugy Florence Parly and Lecornu.

These markers connect directly to Morocco. In Lecornu iPhone XS the Cybersecurity Agency found two indicators tied to bergers.o79@gmail.com and bogaardlisa803@gmail.com in Apple cache files. Parly iPhone 12 showed bergers.o79 plus naomiwerff772@gmail.com. Each address matches prior use against Moroccan targets with bergers.o79 linked to journalist Omar Radi device per Amnesty International Security Lab data. Lecornu and Blanquer traces extend into March 2020 after the latest dates identified in the Pegasus Project.

The DGSE stated in an April 2022 letter that its review could associate certain intrusions with Pegasus client nations and viewed them as espionage harming core national interests.

Secrecy and unease at the Élysée

Legal actions after the Forbidden Stories revelations also reveal limited recall among officials possibly targeted. Parly former armed forces minister offered repeated I do not remember answers and stated no suspicion about any responsible agency or government. She likewise did not recall specifics of her meeting with Israeli defense minister Benny Gantz who according to NSO co-founder Shalev Hulio provided a report confirming no French political figures had been Pegasus targets.

Such gaps highlight discomfort at senior levels. France prefers to avoid any association with the Israeli software. The Élysée announced its refusal to buy Pegasus faster than it released findings on Macron phone analysis. The choice occurred in late 2020 as Le Monde reported. Emmanuel Macron conveyed the decision in a defense council session citing sovereignty and reputational concerns while noting use by authoritarian regimes a source close to events confirmed to Forbidden Stories.

Yet uncertainty lingers. Six months after the Élysée veto in June 2021 Jérôme the French distributor submitted an R226 request on behalf of Syans noting that the DGSI sought the software. He added that the budget had received ministerial approval and the project had secured government clearance by end of 2020. Why submit the sales authorization request then? Could intelligence services have acted independently? The director of the National Technical Service for Judicial Surveillance which falls under the DGSI suggested that the European NSO representative Dutch national Rogier R. proceeded alone acknowledging the refusal yet preparing a fresh proposal to the R226 panel.

This introduces further questions for investigators who received no assistance from Morocco after the country declined a letter rogatory request according to magistrates. Ahead of the ministerial visit King Mohammed VI conveyed warm greetings to Macron in a tone of friendship trust and high standards per Kingdom-aligned media. Lecornu is scheduled to attend a luncheon hosted by the king this Thursday.

The path of Gérard Araud former ambassador and later ethics advisor to NSO

In May 2019 Gérard Araud spent 48 hours at NSO offices at the invitation of American fund Novalpina after its acquisition of the Israeli firm. The recently retired official whose final posting was as ambassador to the United States observed that company staff were all young and dressed casually in shorts and T-shirts. During testimony he also noted early doubts about the unusual consulting role offered. In fact I sensed that the NSO product might contain what I would term a backdoor to the Mossad he stated.